Role in IT decision-making process:Align Business & IT GoalsCreate IT StrategyDetermine IT NeedsManage Vendor RelationshipsEvaluate/Specify Brands or VendorsOther RoleAuthorize PurchasesNot Involved

Work Phone:

Company:

Company Size:

Industry:

Street Address

City:

Zip/postal code

State/Province:

Country:

Occasionally, we send subscribers special offers from select partners. Would you like to receive these special partner offers via e-mail?YesNo

Your registration with Eweek will include the following free email newsletter(s):News & Views

By submitting your wireless number, you agree that eWEEK, its related properties, and vendor partners providing content you view may contact you using contact center technology. Your consent is not required to view content or use site features.

By clicking on the "Register" button below, I agree that I have carefully read the Terms of Service and the Privacy Policy and I agree to be legally bound by all such terms.

WEBINAR:On-Demand

Chief information security officers are responsible for developing and establishing cyber-security strategies and policies with their organizations. Yet, according to a new study from Accenture Security, many organizations don't give their CISOs the resources they need and few CISOs have the required influence within enterprises to effect change.

The Securing the Future Enterprise Study Today-2018 report was released on July 10 and is based on a survey of 1,460 C-level executives. Among the highlights of the 36-page report is that 73 percent of respondents agree that cyber-security staff and activities need to be dispersed throughout an enterprise, yet 74 percent noted that cyber-security today is largely a centralized activity.

"The biggest surprise in our survey was the fact that fewer than one-third of CISOs and business leaders collaborate on a cyber-security plan and budget," Ryan LaSalle, managing director, North America Lead, at Accenture Security, told eWEEK.

Further reading

The study also found that only 40 percent of CISOs say they always confer with business-unit leaders to understand the business before proposing a security approach, he added.

"This tells us that that better alignment is needed earlier in the process between the C-suite and CISOs to reduce future cyber-risks," LaSalle said. "It's a two-way street, of course, so as CISOs convey key cyber-risks in more business-relevant terms, they become more valuable to business leaders and more effective at guiding decision making."

Influence

Of particular note, the study also found that CISOs have limited capabilities to influence business units across their organizations. CISOs’ lack of organizational influence is due to many factors, including a lack of understanding of cyber-risks among business executives and sometimes a failure by CISOs to take the initiative to collaborate, according to LaSalle.

"For example, only 38 percent of business leaders bring the CISO into all discussions at the beginning stage of considering new business opportunities, so you cannot influence where you are not aware," he said. "Additionally, enterprise security professionals often only have responsibility for defending enterprise IT, while the attackers and the business owners are engaged across many points of the company's value chain."

LaSalle added that Accenture's research found that most respondents agreed with the idea that some kind of high-level role is needed to be a bridge between security and business units. He said that if CISOs cannot continue to evolve their roles and relationships, they will not be able to have the impact their business needs.

Cloud Computing

One of the areas identified in the Accenture report as being a gap in cyber-security is cloud computing. Seventy-four percent of survey respondents noted that cloud services raise organizational cyber-risk, yet only 44 percent said that cloud technology is protected by their existing cyber-security strategy.

"While many security organizations have established cloud security and cloud governance programs, the gap is most likely attributed to business adoption moving more rapidly and across more dimensions than security can sustain," LaSalle said. "Cloud providers have significant security capabilities that can be deployed at the enterprise's discretion, but nearly half of CISOs acknowledge that their responsibilities for securing the organization are growing faster than their ability to address security issues. Hence the gap."

Helping CISOs

LaSalle said that Accenture's research shows that CISOs are well-established in large companies yet few have the authority and visibility they need to influence business units and build cyber-resilience into their strategy.

"For CISOs to function as sought-after collaborators and trusted partners, they need to work closely with business units to protect and enable the growth initiatives envisioned by top leadership," he said. "Cyber-security is everyone's responsibility, and companies must also spread knowledge among all level of employees by implementing regular awareness training tailored to individuals' roles."

Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.

By submitting your information, you agree that eweek.com may send you eWEEK offers via email, phone and text message, as well as email offers about other products and services that eWEEK believes may be of interest to you. eWEEK will process your information in accordance with the Quinstreet Privacy Policy.

We ran into a problem

We already have your email address on file. Please use the "Forgot your password?" link to create a password, validate your email and login.